Agents you could actually deploy

What you end up with

RISK        | signals        | new_device, cross_border, high_value, contact_changed
RISK        | score          | 100/100 (HIGH, confidence high)
RISK        | recommendation | ESCALATE
HUMAN_GATE  | human_decision | APPROVE_RECOMMENDATION (agent recommended ESCALATE)

The last four lines of a run you’ll build yourself. Every step, every tool call, every decision — written to an append-only file, on your own machine, for free.

That record is the difference between “the AI flagged it” and a reconstruction someone can audit six months later. It is also the part almost no tutorial covers.

Why this course is different

Most agent tutorials stop at “it works.” This one goes to “it’s governed” — which is what separates a demo from something a bank, an insurer, or anyone with real consequences could actually run.

The governed part turns out to be the easy part. It’s an if statement, an input(), and a file append. What’s hard is knowing where to put them:

• A human gate. The agent recommends; a person approves. The model never acts on its own — not because it isn’t good enough, but because accountability attaches to a person.
• An audit trail. What the data said, what the code decided, who approved it, and when.
• The line between judgment and code. What you let the model decide, and what you refuse to. A rule that must hold goes in code, never in a prompt.

What an agent actually is

Strip away the hype and an agent is a loop:

while not done:
    ask the model what to do
    if it wants a tool  →  run the tool, give back the result
    else                →  we're done

Every piece of that is familiar. The only genuinely new thing is that the branch is chosen by a model instead of by your code. A switch statement where the model picks the case.

The course builds that loop from nothing and then hardens it, using a fraud-triage example: an agent that reviews a suspicious card transaction and recommends whether to block it.

The two parts

Part 1 stands on its own — you’ll have a working, governed agent at the end of it. Part 2 is what changes when the same system has to be run by a team.

	Part 1 · Seven steps to a governed agent	Part 2 · Eight steps to a production system
Shape	Seven files, one idea each	A package: five-stage pipeline
You build	The loop, a tool, a guardrail, a gate, a log	Intake → Enrichment → Risk → Case → Gate
The lesson	An agent is a loop you can govern	Judgment leaves the model entirely
Time	About two hours	About two hours

In Part 2 the risk score is computed by explicit weights in plain Python, so the same alert scores the same every time — while the model’s wording changes on every run. Holding both of those facts at once is the point.

The failures are the curriculum

Everything that went wrong while building this is written up, with numbers, rather than edited out:

• A model that ignored its own tool results — and the method that proved it was the model, not the code
• A categoriser that passed once and scored 1/5 over five runs, failing hardest on the only case that mattered
• A router that told a customer their card was blocked when nothing had been blocked
• A case summary that got the risk signals backwards and still recommended correctly — because the recommendation was never its to make

That last one is the whole argument in miniature. You will not make the model reliable; you decide in advance what its unreliability is allowed to touch.

What you need

• A Mac or Linux machine (Windows works with minor changes)
• Python basics — variables, functions, dictionaries
• About four hours for both parts, or two for Part 1
• One 2GB model download, then nothing leaves your machine

No API key. No account. No cost. Everything runs locally on a free model via Ollama.

The fifteen steps

	Step	What it adds
1	1	Talk to the model — and prove it cannot know your data
	2	A tool is just a function
	3	The model decides to call it
	4	The loop — you now have an agent
	5	Judgment vs code — the line that matters
	6	The human gate
	7	The audit log
2	1	The alert and the fixtures — data as a design document
	2	One model call — and the fact it invents
	3	Tools and schemas, written by hand
	4	The loop, plus the argument binding that makes it safe
	5	Intake and enrichment — naming the stages
	6	Risk scoring in code, not by the model
	7	The case worker and the gate
	8	The audit trail

Each step is one new idea and one complete, runnable file. Everything on this site has been run from a clean clone — if a block doesn’t work, that’s a bug worth reporting.

Start with setup →